Privacy policy

Contra HQ is software that helps accountancy practices onboard new clients and prepare VAT work. It is operated by the Contra HQ team (“we”, “us”). Contra HQ is an early-stage product; a UK limited company is being incorporated, and this page will be updated with its registered details once that completes. You can contact us about anything in this policy at team@contra-hq.com.

Most personal data in the service belongs to the clients of the accountancy practice that uses it. For that data the practice is the data controller and we act as its processor, handling the data only on the practice’s instructions. For the practice’s own account data (staff logins and contact details) we are the controller.

• Contact details — names, email addresses and phone numbers of the practice’s staff and of its clients and prospective clients.
• Company information — company names, registration numbers, registered office addresses, incorporation dates, SIC codes and director details, retrieved from the public Companies House register.
• Identity documents — passports and proof-of-address documents supplied by clients during onboarding, and the names and dates extracted from them for verification.
• Tax identifiers — Unique Taxpayer References, VAT registration numbers and Companies House authentication codes.
• Bank details — sort codes and account numbers supplied for direct debit mandates.
• Correspondence — emails and attachments sent to or from the practice’s mailbox as part of onboarding and VAT work.
• Financial records — invoices, receipts, bank statements and bookkeeping records used to prepare VAT returns.
• Technical logs — server logs needed to run and secure the service. When enabled, PostHog receives page categories, upload outcomes, and sanitised error reports to help us improve reliability and usability. These reports exclude document contents, contact details, financial records, and raw error messages.

We process this data to provide the service to the accountancy practice: capturing and qualifying new client enquiries, verifying company and identity details, collecting the documents an accountant is required to obtain, and preparing VAT return workings. The lawful bases are the performance of our contract with the practice, the practice’s legal obligations (including client due diligence), and our legitimate interest in operating and securing the service. We do not sell personal data or use it for advertising.

When a workspace administrator connects a mailbox, Google asks the mailbox owner to approve read access to email and permission to manage drafts and send email. Taj uses the account’s email address, message headers, message bodies, threads and relevant attachments for the practice’s client correspondence, onboarding, bookkeeping and VAT work. We store connection credentials so the service can continue to access the mailbox without asking for the Google password.

Taj stores correspondence, extracted information and documents in Supabase. Relevant content is processed through the OpenAI API to classify messages, extract document details and prepare responses. Authorised practice staff can review this work and send correspondence through the connected mailbox. Enabling mailbox processing can also trigger configured automated replies and follow-up emails.

Taj’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used to provide the user-facing functions described here, not for advertising or sale to third parties.

Mailboxes start paused. Disconnecting a mailbox in Taj pauses its processing but does not revoke its Google authorisation or delete data already stored. To revoke access, remove Taj’s connection in your Google Account connections. To request removal of stored correspondence, documents or connection credentials, contact team@contra-hq.com. We handle these requests with the accountancy practice that controls the records, subject to applicable legal retention requirements.

The service runs on Vercel, and customer data is stored in Supabase (PostgreSQL and file storage). Staff access requires an authenticated session and workspace membership. Google connection credentials are kept in private credential storage and used by the server to access the connected mailbox.

We share data only with the service providers needed to run the software, and only the data each one needs:

• Vercel (application hosting) and Supabase (database, document and private credential storage).
• OpenAI API (classifying correspondence, extracting details from onboarding and bookkeeping documents, and drafting responses). Email content and relevant attachments may be sent to OpenAI for these functions.
• Google (sending and receiving email through the practice’s Gmail mailbox).
• DocuSign (electronic signing of engagement letters).
• Braintrust (AI operation metadata, such as model usage and outcomes, when enabled; email and document contents are excluded).
• PostHog (product usage and sanitised errors, sent to its EU service when enabled).
• Companies House and HMRC (verification lookups against the official registers, such as confirming a company’s status or checking a VAT registration number).

Where a provider processes data outside the UK or EU, we rely on UK GDPR-recognised safeguards such as the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses.

We keep data for as long as we provide the service to the practice, and afterwards only as long as the practice instructs or the law requires. When an engagement ends, the practice’s data is returned or deleted on request.

You have the right to access, correct, export, restrict or delete your personal data, and to object to processing. If your data is held on behalf of an accountancy practice, we will help the practice fulfil your request. To exercise any right, email team@contra-hq.com. You can also complain to the Information Commissioner’s Office (ico.org.uk).

The service sets only essential cookies used to keep signed-in users authenticated. There are no analytics, advertising or third-party tracking cookies. PostHog uses an anonymous identifier held in page memory, which is discarded when the page reloads. Session recording and automatic collection of form input are disabled.

If you believe you have found a security risk or incident affecting this service, tell us at team@contra-hq.com. We assess every report, and where a breach involves personal data we notify the affected practice, HMRC and the Information Commissioner’s Office within 72 hours of becoming aware of it.

When this policy changes we will update it here and revise the date at the top of the page.